Fixed issue for V5+V7 flowsets (#50)

* Fixed issue for V5+V7 flowsets

* Removed dbg

---------

Co-authored-by: Michael Mileusnich <[email protected]>

Author: mikemiles-dev

Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "netflow_parser"
 description = "Parser for Netflow Cisco V5, V7, V9, IPFIX"
-version = "0.2.6"
+version = "0.2.7"
 edition = "2021"
 author = "[email protected]"
 license = "MIT OR Apache-2.0"

RELEASES.md

@@ -1,3 +1,6 @@
+# 0.2.7
+  * Added support for multiple flowsets for V5, V7.
+
 # 0.2.6
   * Re-added static and variable versions as public.
 

SECURITY.md

@@ -4,6 +4,7 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
+| 0.2.7   | :white_check_mark: |
 | 0.2.6   | :white_check_mark: |
 | 0.2.5   | :white_check_mark: |
 | 0.2.4   | :white_check_mark: |

src/snapshots/netflow_parser__tests__tests__it_parses_v5.snap

@@ -5,7 +5,7 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
 - V5:
     header:
       version: 5
-      count: 512
+      count: 1
       sys_up_time:
         secs: 50332
         nanos: 672000000
@@ -16,29 +16,29 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
       engine_id: 7
       sampling_interval: 2057
     body:
-      src_addr: 0.1.2.3
-      dst_addr: 4.5.6.7
-      next_hop: 8.9.0.1
-      input: 515
-      output: 1029
-      d_pkts: 101124105
-      d_octets: 66051
-      first:
-        secs: 67438
-        nanos: 87000000
-      last:
-        secs: 134807
-        nanos: 553000000
-      src_port: 515
-      dst_port: 1029
-      pad1: 6
-      tcp_flags: 7
-      protocol_number: 8
-      protocol_type: Egp
-      tos: 9
-      src_as: 1
-      dst_as: 515
-      src_mask: 4
-      dst_mask: 5
-      pad2: 1543
-
+      set:
+        - src_addr: 0.1.2.3
+          dst_addr: 4.5.6.7
+          next_hop: 8.9.0.1
+          input: 515
+          output: 1029
+          d_pkts: 101124105
+          d_octets: 66051
+          first:
+            secs: 67438
+            nanos: 87000000
+          last:
+            secs: 134807
+            nanos: 553000000
+          src_port: 515
+          dst_port: 1029
+          pad1: 6
+          tcp_flags: 7
+          protocol_number: 8
+          protocol_type: Egp
+          tos: 9
+          src_as: 1
+          dst_as: 515
+          src_mask: 4
+          dst_mask: 5
+          pad2: 1543

src/snapshots/netflow_parser__tests__tests__it_parses_v7.snap

@@ -5,7 +5,7 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
 - V7:
     header:
       version: 7
-      count: 512
+      count: 1
       sys_up_time:
         secs: 50332
         nanos: 672000000
@@ -14,30 +14,30 @@ expression: "NetflowParser::default().parse_bytes(&packet)"
       flow_sequence: 33752069
       reserved: 101124105
     body:
-      src_addr: 0.1.2.3
-      dst_addr: 4.5.6.7
-      next_hop: 8.9.0.1
-      input: 515
-      output: 1029
-      d_pkts: 101124105
-      d_octets: 66051
-      first:
-        secs: 67438
-        nanos: 87000000
-      last:
-        secs: 134807
-        nanos: 553000000
-      src_port: 515
-      dst_port: 1029
-      flags_fields_valid: 6
-      tcp_flags: 7
-      protocol_number: 8
-      protocol_type: Egp
-      tos: 9
-      src_as: 1
-      dst_as: 515
-      src_mask: 4
-      dst_mask: 5
-      flags_fields_invalid: 1543
-      router_src: 8.9.0.1
-
+      set:
+        - src_addr: 0.1.2.3
+          dst_addr: 4.5.6.7
+          next_hop: 8.9.0.1
+          input: 515
+          output: 1029
+          d_pkts: 101124105
+          d_octets: 66051
+          first:
+            secs: 67438
+            nanos: 87000000
+          last:
+            secs: 134807
+            nanos: 553000000
+          src_port: 515
+          dst_port: 1029
+          flags_fields_valid: 6
+          tcp_flags: 7
+          protocol_number: 8
+          protocol_type: Egp
+          tos: 9
+          src_as: 1
+          dst_as: 515
+          src_mask: 4
+          dst_mask: 5
+          flags_fields_invalid: 1543
+          router_src: 8.9.0.1

src/static_versions/v5.rs

@@ -20,6 +20,7 @@ pub struct V5 {
     /// V5 Header
     pub header: Header,
     /// V5 Body
+    #[nom(Parse = "{ |i| Body::parse(i, header.count) }")]
     pub body: Body,
 }
 
@@ -60,7 +61,14 @@ pub struct Header {
 }
 
 #[derive(Debug, PartialEq, Eq, Clone, Serialize, Nom)]
+#[nom(ExtraArgs(count: u16))]
 pub struct Body {
+    #[nom(Count = "count")]
+    set: Vec<FlowSet>,
+}
+
+#[derive(Debug, PartialEq, Eq, Clone, Serialize, Nom)]
+pub struct FlowSet {
     /// Source IP address
     #[nom(Map = "Ipv4Addr::from", Parse = "be_u32")]
     pub src_addr: Ipv4Addr,

src/static_versions/v7.rs

@@ -20,6 +20,7 @@ pub struct V7 {
     /// V7 Header
     pub header: Header,
     /// V7 Body
+    #[nom(Parse = "{ |i| Body::parse(i, header.count) }")]
     pub body: Body,
 }
 
@@ -55,8 +56,15 @@ pub struct Header {
     pub reserved: u32,
 }
 
-#[derive(Debug, PartialEq, Eq, Clone, Nom, Serialize)]
+#[derive(Debug, PartialEq, Eq, Clone, Serialize, Nom)]
+#[nom(ExtraArgs(count: u16))]
 pub struct Body {
+    #[nom(Count = "count")]
+    set: Vec<FlowSet>,
+}
+
+#[derive(Debug, PartialEq, Eq, Clone, Nom, Serialize)]
+pub struct FlowSet {
     /// Source IP address; in case of destination-only flows, set to zero.
     #[nom(Map = "Ipv4Addr::from", Parse = "be_u32")]
     pub src_addr: Ipv4Addr,

src/tests.rs

@@ -40,7 +40,7 @@ mod tests {
     #[cfg(not(feature = "unix_timestamp"))]
     fn it_parses_v5() {
         let packet = [
-            0, 5, 2, 0, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3,
+            0, 5, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3,
             4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1,
             2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7,
         ];
@@ -68,7 +68,7 @@ mod tests {
     #[cfg(not(feature = "unix_timestamp"))]
     fn it_parses_v7() {
         let packet = [
-            0, 7, 2, 0, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3,
+            0, 7, 0, 1, 3, 0, 4, 0, 5, 0, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3,
             4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1,
             2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1,
         ];